As you dig into configurations, you will see attribute names of the FOO-bar form.
The word after the dash is generally referred to as the class. These attributes are special in a few ways:
- Attributes merge across files like any other attribute.
- Only one instance of each class will be applied according to the rules described previously.
- The final set of attributes is applied in the ASCII order by the value of the class. Once again, say we are presented with an event with the following fields:
sourcetype=foo_type source=/logs/abc/def/gh.log host=dns4.nyc.mycompany.com
And, say this is the configuration snippet:
[foo_type] TRANSFORMS-a = from_sourcetype1, from_sourcetype2 [source::/logs/.../*.log] TRANSFORMS-c = from_source_b ...